Messages in this thread | | | Date | Tue, 14 Jun 2016 10:57:29 -0700 | From | Kees Cook <> | Subject | [PULL] seccomp update (next) |
| |
Hi,
Please pull these seccomp changes for next. These have been tested by myself and Andy, and close a long-standing issue with seccomp where tracers could change the syscall out from under seccomp.
Thanks!
-Kees
The following changes since commit 40d273782ff16fe1a7445cc05c66a447dfea3433:
security: tomoyo: simplify the gc kthread creation (2016-06-06 20:23:55 +1000)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/seccomp-next
for you to fetch changes up to 26703c636c1f3272b39bd0f6d04d2e970984f1b6:
um/ptrace: run seccomp after ptrace (2016-06-14 10:54:47 -0700)
---------------------------------------------------------------- Fix seccomp vs ptrace ordering to plug syscall filter bypass issue.
---------------------------------------------------------------- Andy Lutomirski (2): seccomp: Add a seccomp_data parameter secure_computing() x86/entry: Get rid of two-phase syscall entry work
Kees Cook (12): seccomp: add tests for ptrace hole seccomp: remove 2-phase API seccomp: recheck the syscall after RET_TRACE x86/ptrace: run seccomp after ptrace arm/ptrace: run seccomp after ptrace arm64/ptrace: run seccomp after ptrace MIPS/ptrace: run seccomp after ptrace parisc/ptrace: run seccomp after ptrace s390/ptrace: run seccomp after ptrace powerpc/ptrace: run seccomp after ptrace tile/ptrace: run seccomp after ptrace um/ptrace: run seccomp after ptrace
arch/arm/kernel/ptrace.c | 13 +- arch/arm64/kernel/ptrace.c | 8 +- arch/mips/kernel/ptrace.c | 9 +- arch/parisc/kernel/ptrace.c | 9 +- arch/powerpc/kernel/ptrace.c | 46 +++---- arch/s390/kernel/ptrace.c | 21 ++- arch/tile/kernel/ptrace.c | 11 +- arch/um/kernel/skas/syscall.c | 9 +- arch/x86/entry/common.c | 106 +++------------- arch/x86/entry/vsyscall/vsyscall_64.c | 2 +- arch/x86/include/asm/ptrace.h | 6 - include/linux/seccomp.h | 14 +- kernel/seccomp.c | 144 ++++++++------------- tools/testing/selftests/seccomp/seccomp_bpf.c | 176 ++++++++++++++++++++++++-- 14 files changed, 309 insertions(+), 265 deletions(-)
-- Kees Cook Chrome OS & Brillo Security
| |